Master Real-Time Linux Network Traffic Monitoring with nload, iftop, sar & Scripts

nload tool

nload displays real‑time traffic for a network interface.

yum install -y epel-release
yum install -y nload

After installation, simply run: nload The output shows incoming and outgoing rates, averages, minima, maxima and total traffic for the selected device.

iftop tool

iftop provides a live view of bandwidth usage per connection.

yum install -y epel-release
yum install -y iftop

Run iftop to see an interface similar to the screenshot below.

Key parameters displayed:

Scale bar – visual ruler for traffic graphs.

<= and => arrows – indicate traffic direction.

TX – transmitted traffic.

RX – received traffic.

TOTAL – total traffic.

Cumm – cumulative traffic since iftop started.

Peak – highest traffic observed.

Rates – average traffic over the last 2 s, 10 s and 40 s.

sar command

The sar utility, part of the sysstat package, collects a wide range of system statistics, including network interface metrics. sar -n DEV 1 2 The -n option can be combined with the following sub‑options:

DEV – network interface statistics.

EDEV – network error statistics.

NFS – NFS client activity.

NFSD – NFS server activity.

SOCK – socket statistics.

ALL – all of the above.

Real‑time monitoring script 1

This shell script calculates per‑second inbound and outbound traffic by comparing the current values in /proc/net/dev with the previous second's values.

# Pass the network interface as the first argument
ethn=$1
while true; do
  RX_pre=$(cat /proc/net/dev | grep $ethn | sed 's/:/ /g' | awk '{print $2}')
  TX_pre=$(cat /proc/net/dev | grep $ethn | sed 's/:/ /g' | awk '{print $10}')
  sleep 1
  RX_next=$(cat /proc/net/dev | grep $ethn | sed 's/:/ /g' | awk '{print $2}')
  TX_next=$(cat /proc/net/dev | grep $ethn | sed 's/:/ /g' | awk '{print $10}')
  clear
  echo -e "t RX `date +%k:%M:%S` TX"
  RX=$((RX_next-RX_pre))
  TX=$((TX_next-TX_pre))
  if [[ $RX -lt 1024 ]]; then
    RX="${RX}B/s"
  elif [[ $RX -gt 1048576 ]]; then
    RX=$(echo $RX | awk '{print $1/1048576 "MB/s"}')
  else
    RX=$(echo $RX | awk '{print $1/1024 "KB/s"}')
  fi
  if [[ $TX -lt 1024 ]]; then
    TX="${TX}B/s"
  elif [[ $TX -gt 1048576 ]]; then
    TX=$(echo $TX | awk '{print $1/1048576 "MB/s"}')
  else
    TX=$(echo $TX | awk '{print $1/1024 "KB/s"}')
  fi
  echo "$ethn t $RX   $TX "
done

Sample output shows the interface name followed by the calculated inbound and outbound rates.

Real‑time monitoring script 2

A second script monitors a specified NIC and prints traffic in a single line.

# $1 is the network interface to monitor
NIC=$1
while true; do
  OLD_IN=$(awk '$0~"'$NIC'"{print $2}' /proc/net/dev)
  OLD_OUT=$(awk '$0~"'$NIC'"{print $10}' /proc/net/dev)
  sleep 1
  NEW_IN=$(awk '$0~"'$NIC'"{print $2}' /proc/net/dev)
  NEW_OUT=$(awk '$0~"'$NIC'"{print $10}' /proc/net/dev)
  clear
  IN=$(printf "%.1f%s" $(($NEW_IN-$OLD_IN)) "B/s")
  OUT=$(printf "%.1f%s" $(($NEW_OUT-$OLD_OUT)) "B/s")
  echo "       traffic in  `date +%k:%M:%S`  traffic out "
  echo "$NIC   $IN              $OUT"
done

Running the script (e.g., ./network_flow.sh eth0) prints timestamps with inbound and outbound byte‑per‑second values.